GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22258-1 advisory.

    Changes in python-graphql-core:

    - CVE-2026-75507: Fix quadratic complexity in OverlappingFieldsCanBeMerged       validation rule when comparing nested inline fragments. (bsc#1287830)
    - CVE-2026-75508: Count skipped comment tokens toward the parser max_tokens       limit to prevent memory exhaustion. (bsc#1287829)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and
    3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned
    after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained
    through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass
    a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory
    before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
    (CVE-2026-75508)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and     3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts only non-comment tokens returned     after Lexer.lookahead skips comments. Each skipped comment is still allocated as a Token and retained     through token.next and token.prev, allowing a highly compressible comment-padded GraphQL document to pass     a low token limit while consuming memory. An unauthenticated remote attacker can exhaust worker memory     before AST-based depth or complexity controls run. This issue is fixed in versions 3.2.12 and 3.3.0rc1.
    (CVE-2026-75508)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379534	openSUSE 16 Security Update : python-graphql-core (openSUSE-SU-2026:22258-1)	Nessus	SuSE Local Security Checks	Local	high
477148	Chainguard: elastic-connectors-8.19: security update to 8.19.23-r2	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
477148	Chainguard: elastic-connectors-8.19: security update to 8.19.23-r2	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
371294	Linux Distros Unpatched Vulnerability : CVE-2026-75508	Nessus	Misc.	Local	high
476854	SCA: security update for graphql-core (GHSA-r77w-qph3-7vf8)	Tenable Cloud Security	SCA Checks	Local	high
476854	SCA: security update for graphql-core (GHSA-r77w-qph3-7vf8)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-75508

high

Tenable Plugins

high

high

high

high

high

high